diff --git a/sys/dev/cxgbe/tom/t4_tls.c b/sys/dev/cxgbe/tom/t4_tls.c
--- a/sys/dev/cxgbe/tom/t4_tls.c
+++ b/sys/dev/cxgbe/tom/t4_tls.c
@@ -315,7 +315,7 @@
 		    tls->params.max_frame_len;
 		toep->tls.tx_key_info_size = t4_tls_key_info_size(tls);
 	} else {
-		toep->flags |= TPF_TLS_STARTING | TPF_TLS_RX_QUIESCED;
+		toep->flags |= TPF_TLS_STARTING | TPF_TLS_RX_QUIESCING;
 		toep->tls.rx_version = tls->params.tls_vmajor << 8 |
 		    tls->params.tls_vminor;
 
@@ -1243,6 +1243,10 @@
 {
 	MPASS(toep->flags & TPF_TLS_STARTING);
 
+	/* Data was received before quiescing took effect. */
+	if ((toep->flags & TPF_TLS_RX_QUIESCING) != 0)
+		return;
+
 	/*
 	 * A previous call to tls_check_rx_sockbuf needed more data.
 	 * Now that more data has arrived, quiesce receive again and
@@ -1250,7 +1254,7 @@
 	 */
 	if ((toep->flags & TPF_TLS_RX_QUIESCED) == 0) {
 		CTR(KTR_CXGBE, "%s: tid %d quiescing", __func__, toep->tid);
-		toep->flags |= TPF_TLS_RX_QUIESCED;
+		toep->flags |= TPF_TLS_RX_QUIESCING;
 		t4_set_rx_quiesce(toep);
 		return;
 	}
@@ -1287,6 +1291,10 @@
 		if ((toep->flags & TPF_TLS_STARTING) == 0)
 			panic("%s: connection is not starting TLS RX\n",
 			    __func__);
+		MPASS((toep->flags & TPF_TLS_RX_QUIESCING) != 0);
+
+		toep->flags &= ~TPF_TLS_RX_QUIESCING;
+		toep->flags |= TPF_TLS_RX_QUIESCED;
 
 		so = inp->inp_socket;
 		sb = &so->so_rcv;
diff --git a/sys/dev/cxgbe/tom/t4_tom.h b/sys/dev/cxgbe/tom/t4_tom.h
--- a/sys/dev/cxgbe/tom/t4_tom.h
+++ b/sys/dev/cxgbe/tom/t4_tom.h
@@ -73,8 +73,9 @@
 	TPF_KTLS           = (1 << 11), /* send TLS records from KTLS */
 	TPF_INITIALIZED    = (1 << 12), /* init_toepcb has been called */
 	TPF_TLS_RECEIVE	   = (1 << 13), /* should receive TLS records */
-	TPF_TLS_RX_QUIESCED = (1 << 14), /* RX quiesced for TLS RX startup */
-	TPF_WAITING_FOR_FINAL = (1<< 15), /* waiting for wakeup on final CPL */
+	TPF_TLS_RX_QUIESCING = (1 << 14), /* RX quiesced for TLS RX startup */
+	TPF_TLS_RX_QUIESCED = (1 << 15), /* RX quiesced for TLS RX startup */
+	TPF_WAITING_FOR_FINAL = (1<< 16), /* waiting for wakeup on final CPL */
 };
 
 enum {